From 3a9c6345ecd800abb5e65e2e1eb5c828720c8cc8 Mon Sep 17 00:00:00 2001 From: wj32 Date: Sun, 28 Feb 2010 09:13:46 +0000 Subject: [PATCH] added PhIsExecutablePacked git-svn-id: svn://svn.code.sf.net/p/processhacker/code@2895 21ef857c-d57f-4fe0-8362-d861dc6d29cd --- 2.x/trunk/ProcessHacker/include/ph.h | 7 +++ 2.x/trunk/ProcessHacker/mainwnd.c | 6 +- 2.x/trunk/ProcessHacker/mapimg.c | 8 +-- 2.x/trunk/ProcessHacker/procprv.c | 7 +++ 2.x/trunk/ProcessHacker/support.c | 87 ++++++++++++++++++++++++++++ 5 files changed, 109 insertions(+), 6 deletions(-) diff --git a/2.x/trunk/ProcessHacker/include/ph.h b/2.x/trunk/ProcessHacker/include/ph.h index e989f6491..646a7b4ae 100644 --- a/2.x/trunk/ProcessHacker/include/ph.h +++ b/2.x/trunk/ProcessHacker/include/ph.h @@ -1835,6 +1835,13 @@ VOID PhSetFileDialogFileName( __in PWSTR FileName ); +NTSTATUS PhIsExecutablePacked( + __in PWSTR FileName, + __out PBOOLEAN IsPacked, + __out_opt PULONG NumberOfModules, + __out_opt PULONG NumberOfFunctions + ); + typedef struct _PH_COMMAND_LINE_OPTION { ULONG Id; diff --git a/2.x/trunk/ProcessHacker/mainwnd.c b/2.x/trunk/ProcessHacker/mainwnd.c index 6d44fde1b..a6f29e1b9 100644 --- a/2.x/trunk/ProcessHacker/mainwnd.c +++ b/2.x/trunk/ProcessHacker/mainwnd.c @@ -1186,10 +1186,12 @@ VOID PhMainWndOnCreate() PhAddListViewColumn(ProcessListViewHandle, 3, 3, 3, LVCFMT_LEFT, 300, L"File Name"); PhAddListViewColumn(ProcessListViewHandle, 4, 4, 4, LVCFMT_LEFT, 300, L"Command Line"); PhAddListViewColumn(ProcessListViewHandle, 5, 5, 5, LVCFMT_LEFT, 60, L"CPU"); - PhAddListViewColumn(ProcessListViewHandle, 6, 6, 6, LVCFMT_LEFT, 100, L"Verified Signer"); + PhAddListViewColumn(ProcessListViewHandle, 6, 6, 6, LVCFMT_LEFT, 100, L"Packed"); + PhAddListViewColumn(ServiceListViewHandle, 0, 0, 0, LVCFMT_LEFT, 100, L"Name"); PhAddListViewColumn(ServiceListViewHandle, 1, 1, 1, LVCFMT_LEFT, 140, L"Display Name"); PhAddListViewColumn(ServiceListViewHandle, 2, 2, 2, LVCFMT_LEFT, 50, L"PID"); + PhAddListViewColumn(NetworkListViewHandle, 0, 0, 0, LVCFMT_LEFT, 100, L"Process Name"); PhSetExtendedListView(ServiceListViewHandle); @@ -1798,7 +1800,7 @@ VOID PhMainWndOnProcessModified( if (lvItemIndex != -1) { PhSetListViewSubItem(ProcessListViewHandle, lvItemIndex, 5, ProcessItem->CpuUsageString); - PhSetListViewSubItem(ProcessListViewHandle, lvItemIndex, 6, PhGetString(ProcessItem->VerifySignerName)); + PhSetListViewSubItem(ProcessListViewHandle, lvItemIndex, 6, ProcessItem->IsPacked ? L"Yes" : L"No"); } } diff --git a/2.x/trunk/ProcessHacker/mapimg.c b/2.x/trunk/ProcessHacker/mapimg.c index 6f97a8a0e..f58cf485f 100644 --- a/2.x/trunk/ProcessHacker/mapimg.c +++ b/2.x/trunk/ProcessHacker/mapimg.c @@ -154,7 +154,7 @@ NTSTATUS PhLoadMappedImage( status = PhGetFileSize(FileHandle, &size); if (!NT_SUCCESS(status)) - goto ExitAndCleanup; + goto CleanupExit; status = NtCreateSection( §ionHandle, @@ -167,7 +167,7 @@ NTSTATUS PhLoadMappedImage( ); if (!NT_SUCCESS(status)) - goto ExitAndCleanup; + goto CleanupExit; // Map the section. @@ -188,7 +188,7 @@ NTSTATUS PhLoadMappedImage( ); if (!NT_SUCCESS(status)) - goto ExitAndCleanup; + goto CleanupExit; // Initialize the mapped file. @@ -203,7 +203,7 @@ NTSTATUS PhLoadMappedImage( NtUnmapViewOfSection(NtCurrentProcess(), MappedImage->ViewBase); } -ExitAndCleanup: +CleanupExit: if (sectionHandle) NtClose(sectionHandle); if (openedFile) diff --git a/2.x/trunk/ProcessHacker/procprv.c b/2.x/trunk/ProcessHacker/procprv.c index 33d8668ca..142077cef 100644 --- a/2.x/trunk/ProcessHacker/procprv.c +++ b/2.x/trunk/ProcessHacker/procprv.c @@ -432,6 +432,13 @@ VOID PhpProcessQueryStage2( processItem->FileName->Buffer, &Data->VerifySignerName ); + + PhIsExecutablePacked( + processItem->FileName->Buffer, + &Data->IsPacked, + NULL, + NULL + ); } } diff --git a/2.x/trunk/ProcessHacker/support.c b/2.x/trunk/ProcessHacker/support.c index 64e923135..b6996e24b 100644 --- a/2.x/trunk/ProcessHacker/support.c +++ b/2.x/trunk/ProcessHacker/support.c @@ -1633,6 +1633,93 @@ VOID PhSetFileDialogFileName( } } +NTSTATUS PhIsExecutablePacked( + __in PWSTR FileName, + __out PBOOLEAN IsPacked, + __out_opt PULONG NumberOfModules, + __out_opt PULONG NumberOfFunctions + ) +{ + // An image is packed if: + // + // 1. It references fewer than 3 modules, and + // 2. It imports fewer than 5 functions. + // + // Or: + // + // 1. The function-to-module ratio is lower than 4 + // (on average fewer than 4 functions are imported + // from each module), and + // 2. It references more than 3 modules but fewer than + // 30 modules. + + NTSTATUS status; + PH_MAPPED_IMAGE mappedImage; + PH_MAPPED_IMAGE_IMPORTS imports; + PH_MAPPED_IMAGE_IMPORT_DLL importDll; + ULONG i; + ULONG numberOfModules; + ULONG numberOfFunctions = 0; + BOOLEAN isPacked; + + status = PhLoadMappedImage( + FileName, + NULL, + TRUE, + &mappedImage + ); + + if (!NT_SUCCESS(status)) + return status; + + status = PhInitializeMappedImageImports( + &imports, + &mappedImage + ); + + if (!NT_SUCCESS(status)) + goto CleanupExit; + + // Get the module and function totals. + + numberOfModules = imports.NumberOfDlls; + + for (i = 0; i < numberOfModules; i++) + { + if (!NT_SUCCESS(status = PhGetMappedImageImportDll( + &imports, + i, + &importDll + ))) + goto CleanupExit; + + numberOfFunctions += importDll.NumberOfEntries; + } + + // Determine if the image is packed. + + if ( + (numberOfModules < 3 && numberOfFunctions < 5) || + (((FLOAT)numberOfFunctions / numberOfModules) < 4 && + numberOfModules > 3 && numberOfModules < 30) + ) + { + isPacked = TRUE; + } + + *IsPacked = isPacked; + + if (NumberOfModules) + *NumberOfModules = numberOfModules; + if (NumberOfFunctions) + *NumberOfFunctions = numberOfFunctions; + +CleanupExit: + PhUnloadMappedImage(&mappedImage); + + return status; +} + VOID PhParseCommandLine( __in PPH_STRINGREF CommandLine, __in PPH_COMMAND_LINE_OPTION Options,